Remediation

Remediation addresses the root cause of a compromise rather than simply limiting its immediate spread. It may include removing malware, patching exploited vulnerabilities, resetting compromised credentials, rebuilding affected systems, and closing the access vector the attacker used. Effective remediation requires a thorough understanding of the full scope of the attack, which is why complete incident investigation is a prerequisite for lasting recovery.